Documentation

#!/bin/bash

# Generate principal mapping file for tfplan2md

echo '{'
echo '  "users": {'

# Fetch users
az ad user list --query '[].{id:id,upn:userPrincipalName}' -o json | \
  jq -r '.[] | "    \"" + .id + "\": \"" + .upn + "\""' | \
  paste -sd ',' -

echo '  },'
echo '  "groups": {'

# Fetch groups
az ad group list --query '[].{id:id,name:displayName}' -o json | \
  jq -r '.[] | "    \"" + .id + "\": \"" + .name + "\""' | \
  paste -sd ',' -

echo '  },'
echo '  "servicePrincipals": {'

# Fetch service principals
az ad sp list --all --query '[].{id:id,name:displayName}' -o json | \
  jq -r '.[] | "    \"" + .id + "\": \"" + .name + "\""' | \
  paste -sd ',' -

echo '  }'
echo '}'

# Generate principal mapping file for tfplan2md

$mapping = @{
    users = @{}
    groups = @{}
    servicePrincipals = @{}
}

# Fetch users
Write-Host "Fetching users..." -ForegroundColor Cyan
$users = az ad user list --query '[].{id:id,upn:userPrincipalName}' | ConvertFrom-Json
foreach ($user in $users) {
    $mapping.users[$user.id] = $user.upn
}

# Fetch groups
Write-Host "Fetching groups..." -ForegroundColor Cyan
$groups = az ad group list --query '[].{id:id,name:displayName}' | ConvertFrom-Json
foreach ($group in $groups) {
    $mapping.groups[$group.id] = $group.name
}

# Fetch service principals
Write-Host "Fetching service principals..." -ForegroundColor Cyan
$sps = az ad sp list --all --query '[].{id:id,name:displayName}' | ConvertFrom-Json
foreach ($sp in $sps) {
    $mapping.servicePrincipals[$sp.id] = $sp.name
}

# Output JSON
$mapping | ConvertTo-Json -Depth 3

# Extract principal IDs from Terraform plan
PRINCIPAL_IDS=$(terraform show -json plan.tfplan | \
  jq -r '.resource_changes[]? | 
    select(.type == "azurerm_role_assignment") | 
    .change.after.principal_id' | sort -u)

# Create mapping for only those principals
echo '{"users":{},"groups":{},"servicePrincipals":{}}'  > principals.json
for id in $PRINCIPAL_IDS; do
  # Try as user
  az ad user show --id "$id" 2>/dev/null | \
    jq -r '{users: {($id): .userPrincipalName}}' || \
  # Try as group
  az ad group show --group "$id" 2>/dev/null | \
    jq -r '{groups: {($id): .displayName}}' || \
  # Try as service principal
  az ad sp show --id "$id" 2>/dev/null | \
    jq -r '{servicePrincipals: {($id): .displayName}}'
done | jq -s 'reduce .[] as $item ({}; . * $item)' > principals.json